Privacy Policy

Effective October 6, 2026

MailDobie is an email-security service operated by WN Mackenjas LLC ("we", "us"). It watches the mailbox you connect for phishing, spoofed senders, malicious links and accidental leaks of sensitive data, and warns you. Your privacy comes first in how it is built: we keep as little as we can, for as short a time as we can, and you can delete everything yourself at any time.

What MailDobie can access

• Google accounts: read-only access to your Gmail (gmail.readonly) and your email address. If Google also shares your display name, we use it only to label your account. We cannot send, delete or change your mail.
• Microsoft accounts: read access to your mail and basic profile (Mail.Read, User.Read, offline_access). An optional feature that adds warnings inside messages needs extra permission (Mail.ReadWrite); it is turned off and is only requested if it is ever enabled.
• Passwords: we never see them. You sign in on Google's or Microsoft's own page.

How we use it

We read the messages you receive and send in your connected mailbox, in memory, only to look for threats and sensitive-data leaks, and to show you the result in your dashboard and in alert and summary emails sent to you. We do not use your email for advertising, we do not sell it, and we do not use it to train AI models.

What we store

• Not stored: the body of your emails and attachments. They are examined in memory and discarded.
• Stored for each scanned message: sender address and display name, the verified sending domain, your address as recipient, the time received, and technical authentication headers.
• Stored for each alert: the type and severity, why it was flagged, any link address or flagged attachment file name, and the sender. Subject lines are not stored.
• Stored for messages you send: the recipient addresses and send time, to spot risky sends.
• Stored for your account: your email address, your display name if Google provides it, an optional nickname, and the encrypted connection token that lets scanning continue while you are signed out.
• Sign-in sessions and security logs: a session record while you are signed in, and IP addresses of failed administrator log-in attempts.

How long we keep it

• Scan records and alerts are deleted automatically after 30 days.
• Your connection token is kept only while your account stays connected.
• Choose Disconnect and delete my data in the app and everything we hold about your account (token, alerts, scan records, sessions) is deleted immediately. For Google accounts we also revoke our access with Google. You can additionally remove MailDobie at myaccount.google.com/permissions or account.microsoft.com/privacy/app-access.
• The sign-in page can show when you last signed in and out. Those two times are kept only in your own browser on your device. They are never sent to us.
• Signing out ends your session but does not delete your data; the connection must stay in place for scanning to keep working.

Who can see it

• You can see your own dashboard. No other customer can see your data.
• The MailDobie administrator can view alert records in the administration dashboard, only to run and support the service.
• We do not sell or share your data with anyone else, except service providers we need to run MailDobie (cloud hosting and outgoing email delivery for your alerts and summaries), who may handle it only to provide those services, or where the law requires it.

Google API Services user data

MailDobie's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use Gmail data only to provide the threat detection you see in the app, we do not transfer it to others except as needed to provide that feature, to comply with law, or for security, and no human reads your mail except with your consent for support, for security investigations, or when required by law.

Security

Connection tokens are encrypted with AES-256-GCM before they are saved, with the key kept outside the database. All traffic uses HTTPS, accounts are separated so each person can only reach their own data, and administrator log-in is rate-limited and locked after repeated failures.

Your choices and rights

You can disconnect and delete your data in the app at any time, or email us and we will do it for you. You may ask what we hold about you or ask for a correction. MailDobie is not intended for children under 16.

Changes and contact

If we change this policy in a way that matters, we will update the date above and tell connected users. Questions or requests: contact@wnmackenjas.com.